Flax Typhoon
China-based state-sponsored hacking group, targeting Taiwan first, enabled by Beijing firm Integrity Tech.
On 8 October 2026 ten agencies from seven countries tied Flax Typhoon's methods to hackers enabled by Integrity Technology Group, a for-profit Beijing company, in advisory AA26-281A, widening the known victims from Taiwan to US government and healthcare bodies.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why did ten agencies name a Beijing company rather than Flax Typhoon itself?
Timeline for Flax Typhoon
Ten agencies name Beijing firm in hacks
Cybersecurity: Threats and DefencesUAT-8616 keeps Cisco SD-WAN under fire
Cybersecurity: Threats and DefencesMentioned in: Norway joins the Salt Typhoon victim list
Cybersecurity: Threats and DefencesSixteen cyber agencies name Flax Typhoon network
Cybersecurity: Threats and DefencesBackground
Microsoft coined the name Flax Typhoon in August 2023 for a China-based, state-sponsored group it had watched since mid-2021. Its first report described intrusions into Taiwanese government, education, manufacturing and technology organisations that relied on legitimate software such as SoftEther VPN rather than custom malware. Other security firms track the same activity as ETHEREAL PANDA and RedJuliett, and Recorded Future treats RedJuliett as a close overlap rather than an exact match.
In September 2024 the FBI and its partners said Integrity Technology Group controlled a botnet of more than 260,000 compromised routers, cameras and storage devices that Flax Typhoon used. Sanctions on the company followed from the US Treasury on 3 January 2025, the UK on 9 December 2025 and the EU in March 2026; the EU Council said Flax Typhoon had reached devices in six member states.
Flax Typhoon's covert relay networks also surface in other campaigns. US authorities said in May 2026 that UAT-8616, a China-linked group exploiting a maximum-severity Cisco SD-WAN flaw, used tools tied to the same relay infrastructure.
Allies trace the group through a contractor
Western and Asian governments have twice in 2026 put Flax Typhoon at the centre of a joint warning. On 23 April sixteen national agencies named the group and Integrity Tech as operators of more than 200,000 hijacked home routers, and conceded that blocklists of hacker addresses age faster than defenders can refresh them.
AA26-281A followed on 8 October with the FBI, NSA, CISA and Britain's NCSC among its ten signatories. It listed US government, healthcare and IT victims plus email theft in Southeast Asia, and Japan's police traced linked indicators to January 2016. CISA gave federal bodies until 11 October to fix five exploited flaws dating from 2015 to 2023. Naming the supplier signals the allies' view that Beijing's hacking runs through commercial firms.
How does Flax Typhoon avoid detection?
What is the connection between Flax Typhoon and Integrity Technology Group?
When was Flax Typhoon first publicly disclosed?
Is UAT-8616 part of Flax Typhoon?
Is Flax Typhoon the same as RedJuliett?
Who does Flax Typhoon target?
